2018-10-09 06:18:46 +00:00
# URLhaus Malicious URL Blocklist
2018-10-08 10:53:50 +00:00
2020-06-08 00:56:36 +00:00
A blocklist of malicious websites that are being used for malware distribution, based on the **Database dump (CSV)** of Abuse.ch [URLhaus ](https://urlhaus.abuse.ch/ ). Blocklist is updated twice a day.
2018-10-09 06:18:46 +00:00
2020-04-19 05:41:03 +00:00
There are multiple formats available, refer to the appropriate section according to the program used:
2020-04-07 06:51:21 +00:00
2020-04-19 05:41:03 +00:00
- uBlock Origin (uBO) -> [URL-based ](#url-based ) section (recommended)
- Pi-hole -> [Domain-based ](#domain-based ) or [Hosts-based ](#hosts-based ) section
- Hosts file -> [Hosts-based ](#hosts-based ) section
2020-04-19 08:42:25 +00:00
- Dnsmasq -> [Dnsmasq ](#dnsmasq ) section
- BIND -> [BIND ](#bind ) section
- Unbound -> [Unbound ](#unbound ) section
2020-04-07 06:51:21 +00:00
2020-04-19 05:41:03 +00:00
Not sure which format to choose? See [Compatibility ](https://gitlab.com/curben/urlhaus-filter/wikis/compatibility ) page in the wiki.
2020-04-07 06:51:21 +00:00
## URL-based
2018-10-09 06:18:46 +00:00
2020-06-08 00:56:36 +00:00
Import the following URL into uBO to subscribe (includes online and **offline** malicious websites):
2018-10-09 06:18:46 +00:00
2019-04-29 11:17:26 +00:00
- https://gitlab.com/curben/urlhaus-filter/raw/master/urlhaus-filter.txt
2019-10-14 13:14:38 +00:00
< details >
< summary > Mirrors< / summary >
2019-04-29 11:17:26 +00:00
2019-10-01 12:25:35 +00:00
- https://cdn.statically.io/gl/curben/urlhaus-filter/raw/master/urlhaus-filter.txt
2019-04-29 11:17:26 +00:00
- https://glcdn.githack.com/curben/urlhaus-filter/raw/master/urlhaus-filter.txt
2019-10-01 12:25:35 +00:00
- https://raw.githubusercontent.com/curbengh/urlhaus-filter/master/urlhaus-filter.txt
- https://cdn.statically.io/gh/curbengh/urlhaus-filter/master/urlhaus-filter.txt
- https://gitcdn.xyz/repo/curbengh/urlhaus-filter/master/urlhaus-filter.txt
- https://cdn.jsdelivr.net/gh/curbengh/urlhaus-filter/urlhaus-filter.txt
2019-10-02 02:44:27 +00:00
- https://repo.or.cz/urlhaus-filter.git/blob_plain/refs/heads/master:/urlhaus-filter.txt
2018-10-09 06:18:46 +00:00
2019-10-14 13:14:38 +00:00
< / details >
2019-06-13 06:56:45 +00:00
< br / >
2020-06-08 00:56:36 +00:00
Lite version (**online** links only):
2019-06-13 06:56:45 +00:00
- https://gitlab.com/curben/urlhaus-filter/raw/master/urlhaus-filter-online.txt
2019-10-14 13:14:38 +00:00
< details >
< summary > Mirrors< / summary >
2019-06-13 06:56:45 +00:00
2019-10-01 12:25:35 +00:00
- https://cdn.statically.io/gl/curben/urlhaus-filter/raw/master/urlhaus-filter-online.txt
2019-06-13 06:56:45 +00:00
- https://glcdn.githack.com/curben/urlhaus-filter/raw/master/urlhaus-filter-online.txt
2019-10-01 12:25:35 +00:00
- https://raw.githubusercontent.com/curbengh/urlhaus-filter/master/urlhaus-filter-online.txt
- https://cdn.statically.io/gh/curbengh/urlhaus-filter/master/urlhaus-filter-online.txt
- https://gitcdn.xyz/repo/curbengh/urlhaus-filter/master/urlhaus-filter-online.txt
- https://cdn.jsdelivr.net/gh/curbengh/urlhaus-filter/urlhaus-filter-online.txt
2019-10-02 02:44:27 +00:00
- https://repo.or.cz/urlhaus-filter.git/blob_plain/refs/heads/master:/urlhaus-filter-online.txt
2019-06-13 06:56:45 +00:00
2019-10-14 13:14:38 +00:00
< / details >
2019-06-13 06:56:45 +00:00
2020-06-08 00:56:36 +00:00
**Note:** Lite version is ~95% smaller by excluding offline urls. The status of urls is determined by the upstream Abuse.ch. However, the test is not 100% accurate and some malicious urls that are otherwise accessible may be missed. If bandwidth (4 MB/day) is not a constraint, I recommend the regular version.
2019-06-13 06:56:45 +00:00
2020-06-08 00:56:36 +00:00
*PS: While regular version contains roughly >145K filters, uBO can [easily handle ](https://github.com/uBlockOrigin/uBlock-issues/issues/338#issuecomment-452843669 ) half a million filters.*
2019-06-13 06:56:45 +00:00
2020-04-19 05:41:03 +00:00
## Domain-based
This blocklist includes domains and IP addresses.
- https://gitlab.com/curben/urlhaus-filter/raw/master/urlhaus-filter-domains.txt
< details >
< summary > Mirrors< / summary >
- https://cdn.statically.io/gl/curben/urlhaus-filter/raw/master/urlhaus-filter-domains.txt
- https://glcdn.githack.com/curben/urlhaus-filter/raw/master/urlhaus-filter-domains.txt
- https://raw.githubusercontent.com/curbengh/urlhaus-filter/master/urlhaus-filter-domains.txt
- https://cdn.statically.io/gh/curbengh/urlhaus-filter/master/urlhaus-filter-domains.txt
- https://gitcdn.xyz/repo/curbengh/urlhaus-filter/master/urlhaus-filter-domains.txt
- https://cdn.jsdelivr.net/gh/curbengh/urlhaus-filter/urlhaus-filter-domains.txt
- https://repo.or.cz/urlhaus-filter.git/blob_plain/refs/heads/master:/urlhaus-filter-domains.txt
2019-04-29 11:17:26 +00:00
2020-04-19 05:41:03 +00:00
< / details >
2019-04-29 11:17:26 +00:00
2020-04-19 05:41:03 +00:00
< br / >
Lite version (online domains/IPs only):
2019-10-01 06:58:46 +00:00
2020-04-19 05:41:03 +00:00
- https://gitlab.com/curben/urlhaus-filter/raw/master/urlhaus-filter-domains-online.txt
2019-10-01 06:58:46 +00:00
2020-04-19 05:41:03 +00:00
< details >
< summary > Mirrors< / summary >
2019-10-01 06:58:46 +00:00
2020-04-19 05:41:03 +00:00
- https://cdn.statically.io/gl/curben/urlhaus-filter/raw/master/urlhaus-filter-domains-online.txt
- https://glcdn.githack.com/curben/urlhaus-filter/raw/master/urlhaus-filter-domains-online.txt
- https://raw.githubusercontent.com/curbengh/urlhaus-filter/master/urlhaus-filter-domains-online.txt
- https://cdn.statically.io/gh/curbengh/urlhaus-filter/master/urlhaus-filter-domains-online.txt
- https://gitcdn.xyz/repo/curbengh/urlhaus-filter/master/urlhaus-filter-domains-online.txt
- https://cdn.jsdelivr.net/gh/curbengh/urlhaus-filter/urlhaus-filter-domains-online.txt
- https://repo.or.cz/urlhaus-filter.git/blob_plain/refs/heads/master:/urlhaus-filter-domains-online.txt
2019-10-01 06:58:46 +00:00
2020-04-19 05:41:03 +00:00
< / details >
## Hosts-based
2019-04-29 11:17:26 +00:00
2020-04-19 05:41:03 +00:00
This blocklist includes domains only.
2019-06-28 10:21:42 +00:00
2019-10-01 06:58:46 +00:00
- https://gitlab.com/curben/urlhaus-filter/raw/master/urlhaus-filter-hosts.txt
2019-10-14 13:14:38 +00:00
< details >
< summary > Mirrors< / summary >
2019-10-01 06:58:46 +00:00
2019-10-01 12:25:35 +00:00
- https://cdn.statically.io/gl/curben/urlhaus-filter/raw/master/urlhaus-filter-hosts.txt
2019-10-01 06:58:46 +00:00
- https://glcdn.githack.com/curben/urlhaus-filter/raw/master/urlhaus-filter-hosts.txt
2019-10-01 12:25:35 +00:00
- https://raw.githubusercontent.com/curbengh/urlhaus-filter/master/urlhaus-filter-hosts.txt
- https://cdn.statically.io/gh/curbengh/urlhaus-filter/master/urlhaus-filter-hosts.txt
- https://gitcdn.xyz/repo/curbengh/urlhaus-filter/master/urlhaus-filter-hosts.txt
- https://cdn.jsdelivr.net/gh/curbengh/urlhaus-filter/urlhaus-filter-hosts.txt
2019-10-02 02:44:27 +00:00
- https://repo.or.cz/urlhaus-filter.git/blob_plain/refs/heads/master:/urlhaus-filter-hosts.txt
2019-10-01 06:58:46 +00:00
2019-10-14 13:14:38 +00:00
< / details >
2019-10-01 06:58:46 +00:00
< br / >
2020-04-19 05:41:03 +00:00
Lite version (online domains only):
2019-10-01 06:58:46 +00:00
- https://gitlab.com/curben/urlhaus-filter/raw/master/urlhaus-filter-hosts-online.txt
2019-10-14 13:14:38 +00:00
< details >
< summary > Mirrors< / summary >
2019-10-01 06:58:46 +00:00
2019-10-01 12:25:35 +00:00
- https://cdn.statically.io/gl/curben/urlhaus-filter/raw/master/urlhaus-filter-hosts-online.txt
2019-10-01 06:58:46 +00:00
- https://glcdn.githack.com/curben/urlhaus-filter/raw/master/urlhaus-filter-hosts-online.txt
2019-10-01 12:25:35 +00:00
- https://raw.githubusercontent.com/curbengh/urlhaus-filter/master/urlhaus-filter-hosts-online.txt
- https://cdn.statically.io/gh/curbengh/urlhaus-filter/master/urlhaus-filter-hosts-online.txt
- https://gitcdn.xyz/repo/curbengh/urlhaus-filter/master/urlhaus-filter-hosts-online.txt
- https://cdn.jsdelivr.net/gh/curbengh/urlhaus-filter/urlhaus-filter-hosts-online.txt
2019-10-02 02:44:27 +00:00
- https://repo.or.cz/urlhaus-filter.git/blob_plain/refs/heads/master:/urlhaus-filter-hosts-online.txt
2019-06-28 10:21:42 +00:00
2019-10-14 13:14:38 +00:00
< / details >
2020-03-30 03:19:25 +00:00
## Dnsmasq
2020-04-19 05:41:03 +00:00
This blocklist includes domains only.
2020-03-30 03:19:25 +00:00
### Install
```
2020-04-19 13:14:32 +00:00
# Create a new folder to store the blocklist
mkdir -p /usr/local/etc/dnsmasq/
2020-03-30 03:19:25 +00:00
2020-04-19 13:14:32 +00:00
# Create a new cron job for daily update
printf '#!/bin/sh\ncurl -L "https://gitlab.com/curben/urlhaus-filter/raw/master/urlhaus-filter-dnsmasq.conf" -o "/usr/local/etc/dnsmasq/urlhaus-filter-dnsmasq.conf"\n' > /etc/cron.daily/urlhaus-filter
2020-03-30 03:19:25 +00:00
2020-04-19 13:14:32 +00:00
# cron job requires execution permission
chmod 755 /etc/cron.daily/urlhaus-filter
# Configure dnsmasq to use the blocklist
printf "\nconf-file=/usr/local/etc/dnsmasq/urlhaus-filter-dnsmasq.conf\n" >> /etc/dnsmasq.conf
2020-03-30 03:19:25 +00:00
```
< details >
< summary > Mirrors< / summary >
- https://cdn.statically.io/gl/curben/urlhaus-filter/raw/master/urlhaus-filter-dnsmasq.conf
- https://glcdn.githack.com/curben/urlhaus-filter/raw/master/urlhaus-filter-dnsmasq.conf
- https://raw.githubusercontent.com/curbengh/urlhaus-filter/master/urlhaus-filter-dnsmasq.conf
- https://cdn.statically.io/gh/curbengh/urlhaus-filter/master/urlhaus-filter-dnsmasq.conf
- https://gitcdn.xyz/repo/curbengh/urlhaus-filter/master/urlhaus-filter-dnsmasq.conf
- https://cdn.jsdelivr.net/gh/curbengh/urlhaus-filter/urlhaus-filter-dnsmasq.conf
- https://repo.or.cz/urlhaus-filter.git/blob_plain/refs/heads/master:/urlhaus-filter-dnsmasq.conf
< / details >
< br / >
2020-04-19 05:41:03 +00:00
Lite version (online domains only):
2020-03-30 03:19:25 +00:00
- https://gitlab.com/curben/urlhaus-filter/raw/master/urlhaus-filter-dnsmasq-online.conf
< details >
< summary > Mirrors< / summary >
- https://cdn.statically.io/gl/curben/urlhaus-filter/raw/master/urlhaus-filter-dnsmasq-online.conf
- https://glcdn.githack.com/curben/urlhaus-filter/raw/master/urlhaus-filter-dnsmasq-online.conf
- https://raw.githubusercontent.com/curbengh/urlhaus-filter/master/urlhaus-filter-dnsmasq-online.conf
- https://cdn.statically.io/gh/curbengh/urlhaus-filter/master/urlhaus-filter-dnsmasq-online.conf
- https://gitcdn.xyz/repo/curbengh/urlhaus-filter/master/urlhaus-filter-dnsmasq-online.conf
- https://cdn.jsdelivr.net/gh/curbengh/urlhaus-filter/urlhaus-filter-dnsmasq-online.conf
- https://repo.or.cz/urlhaus-filter.git/blob_plain/refs/heads/master:/urlhaus-filter-dnsmasq-online.conf
< / details >
2020-04-19 08:02:03 +00:00
## BIND
This blocklist includes domains only.
### Install
```
2020-04-19 13:14:32 +00:00
# Create a new folder to store the blocklist
mkdir -p /usr/local/etc/bind/
# Create a new cron job for daily update
printf '#!/bin/sh\ncurl -L "https://gitlab.com/curben/urlhaus-filter/raw/master/urlhaus-filter-bind.conf" -o "/usr/local/etc/bind/urlhaus-filter-bind.conf"\n' > /etc/cron.daily/urlhaus-filter
# cron job requires execution permission
chmod 755 /etc/cron.daily/urlhaus-filter
# Configure BIND to use the blocklist
printf '\ninclude "/usr/local/etc/bind/urlhaus-filter-bind.conf";\n' >> /etc/bind/named.conf
2020-04-19 08:02:03 +00:00
```
Add this to "/etc/bind/null.zone.file" (skip this step if the file already exists):
```
$TTL 86400 ; one day
@ IN SOA ns.nullzone.loc. ns.nullzone.loc. (
2017102203
28800
7200
864000
86400 )
NS ns.nullzone.loc.
A 0.0.0.0
@ IN A 0.0.0.0
* IN A 0.0.0.0
```
Zone file is derived from [here ](https://github.com/tomzuu/blacklist-named/blob/master/null.zone.file ).
< details >
< summary > Mirrors< / summary >
- https://cdn.statically.io/gl/curben/urlhaus-filter/raw/master/urlhaus-filter-bind.conf
- https://glcdn.githack.com/curben/urlhaus-filter/raw/master/urlhaus-filter-bind.conf
- https://raw.githubusercontent.com/curbengh/urlhaus-filter/master/urlhaus-filter-bind.conf
- https://cdn.statically.io/gh/curbengh/urlhaus-filter/master/urlhaus-filter-bind.conf
- https://gitcdn.xyz/repo/curbengh/urlhaus-filter/master/urlhaus-filter-bind.conf
- https://cdn.jsdelivr.net/gh/curbengh/urlhaus-filter/urlhaus-filter-bind.conf
- https://repo.or.cz/urlhaus-filter.git/blob_plain/refs/heads/master:/urlhaus-filter-bind.conf
< / details >
< br / >
Lite version (online domains only):
- https://gitlab.com/curben/urlhaus-filter/raw/master/urlhaus-filter-bind-online.conf
< details >
< summary > Mirrors< / summary >
- https://cdn.statically.io/gl/curben/urlhaus-filter/raw/master/urlhaus-filter-bind-online.conf
- https://glcdn.githack.com/curben/urlhaus-filter/raw/master/urlhaus-filter-bind-online.conf
- https://raw.githubusercontent.com/curbengh/urlhaus-filter/master/urlhaus-filter-bind-online.conf
- https://cdn.statically.io/gh/curbengh/urlhaus-filter/master/urlhaus-filter-bind-online.conf
- https://gitcdn.xyz/repo/curbengh/urlhaus-filter/master/urlhaus-filter-bind-online.conf
- https://cdn.jsdelivr.net/gh/curbengh/urlhaus-filter/urlhaus-filter-bind-online.conf
- https://repo.or.cz/urlhaus-filter.git/blob_plain/refs/heads/master:/urlhaus-filter-bind-online.conf
< / details >
2020-03-30 03:19:25 +00:00
2020-04-19 08:42:25 +00:00
## Unbound
This blocklist includes domains only.
### Install
```
2020-04-19 13:14:32 +00:00
# Create a new folder to store the blocklist
mkdir -p /usr/local/etc/unbound/
2020-04-19 08:42:25 +00:00
2020-04-19 13:14:32 +00:00
# Create a new cron job for daily update
printf '#!/bin/sh\ncurl -L "https://gitlab.com/curben/urlhaus-filter/raw/master/urlhaus-filter-unbound.conf" -o "/usr/local/etc/unbound/urlhaus-filter-unbound.conf"\n' > /etc/cron.daily/urlhaus-filter
2020-04-19 08:42:25 +00:00
2020-04-19 13:14:32 +00:00
# cron job requires execution permission
chmod 755 /etc/cron.daily/urlhaus-filter
# Configure Unbound to use the blocklist
printf '\n include: "/usr/local/etc/unbound/urlhaus-filter-unbound.conf"\n' >> /etc/unbound/unbound.conf
2020-04-19 08:42:25 +00:00
```
< details >
< summary > Mirrors< / summary >
- https://cdn.statically.io/gl/curben/urlhaus-filter/raw/master/urlhaus-filter-unbound.conf
- https://glcdn.githack.com/curben/urlhaus-filter/raw/master/urlhaus-filter-unbound.conf
- https://raw.githubusercontent.com/curbengh/urlhaus-filter/master/urlhaus-filter-unbound.conf
- https://cdn.statically.io/gh/curbengh/urlhaus-filter/master/urlhaus-filter-unbound.conf
- https://gitcdn.xyz/repo/curbengh/urlhaus-filter/master/urlhaus-filter-unbound.conf
- https://cdn.jsdelivr.net/gh/curbengh/urlhaus-filter/urlhaus-filter-unbound.conf
- https://repo.or.cz/urlhaus-filter.git/blob_plain/refs/heads/master:/urlhaus-filter-unbound.conf
< / details >
< br / >
Lite version (online domains only):
- https://gitlab.com/curben/urlhaus-filter/raw/master/urlhaus-filter-unbound-online.conf
< details >
< summary > Mirrors< / summary >
- https://cdn.statically.io/gl/curben/urlhaus-filter/raw/master/urlhaus-filter-unbound-online.conf
- https://glcdn.githack.com/curben/urlhaus-filter/raw/master/urlhaus-filter-unbound-online.conf
- https://raw.githubusercontent.com/curbengh/urlhaus-filter/master/urlhaus-filter-unbound-online.conf
- https://cdn.statically.io/gh/curbengh/urlhaus-filter/master/urlhaus-filter-unbound-online.conf
- https://gitcdn.xyz/repo/curbengh/urlhaus-filter/master/urlhaus-filter-unbound-online.conf
- https://cdn.jsdelivr.net/gh/curbengh/urlhaus-filter/urlhaus-filter-unbound-online.conf
- https://repo.or.cz/urlhaus-filter.git/blob_plain/refs/heads/master:/urlhaus-filter-unbound-online.conf
< / details >
2018-11-12 00:49:13 +00:00
## Issues
2018-10-09 06:18:46 +00:00
2020-06-08 00:56:36 +00:00
The default [URL-based ](#url-based ) blocklist does include **offline** links and may have false positive. Report any false positive by creating an [issue ](https://gitlab.com/curben/urlhaus-filter/issues ) or [merge request ](https://gitlab.com/curben/urlhaus-filter/merge_requests ).
2018-10-09 06:18:46 +00:00
2020-06-08 00:56:36 +00:00
This filter **only** accepts new malware URLs from [URLhaus ](https://urlhaus.abuse.ch/ ).
2018-10-09 06:18:46 +00:00
2019-04-29 11:49:38 +00:00
Please report new malware URL to the upstream maintainer through https://urlhaus.abuse.ch/api/#submit.
2018-10-09 06:18:46 +00:00
2019-03-07 00:39:54 +00:00
## Cloning
Since the filter is updated frequently, cloning the repo would become slower over time as the revision grows.
2019-05-11 10:05:19 +00:00
Use shallow clone to get the recent revisions only. Getting the last five revisions should be sufficient for a valid MR.
2019-03-07 00:39:54 +00:00
`git clone --depth 5 https://gitlab.com/curben/urlhaus-filter.git`
2020-07-06 03:53:37 +00:00
## FAQ
See [FAQ ](https://gitlab.com/curben/urlhaus-filter/wikis/faq ).
2018-11-12 00:49:13 +00:00
## License
[Creative Commons Zero v1.0 Universal ](LICENSE.md )
2020-07-06 03:53:37 +00:00
[Tranco List ](https://tranco-list.eu/ ): MIT License
2018-10-09 06:18:46 +00:00
2020-07-06 03:53:37 +00:00
[Umbrella Popularity List ](https://s3-us-west-1.amazonaws.com/umbrella-static/index.html ): Available free of charge by Cisco Umbrella
This repository is not endorsed by Abuse.ch.
